And a few extra additional seconds of research shows that they don't change the token unless you change your password, as opposed to having the token expire aft

And a few extra additional seconds of research shows that they don't change the token unless you change your password, as opposed to having the token expire after every session. Very bad security practice.